[BUG] OAuth login fails with "Invalid code" in GitHub Codespaces — both browser-redirect and setup-token flows affected

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Login fails with an "Invalid code" OAuth error in a GitHub Codespace. Both the standard /login browser-redirect flow and the claude setup-token manual flow fail the same way. This Codespace has authenticated successfully many times before; this is a new, sudden failure with no config changes on my end.

### What Should Happen?

Claude Code should authenticate successfully after completing the browser authorization step and returning the code to the terminal.

### Error Messages/Logs

```shell
OAuth error: Invalid code. Please make sure the full code was copied
Press Enter to retry.
Esc to cancel

This site can't be reached
localhost refused to connect.
ERR_CONNECTION_REFUSED
```

### Steps to Reproduce

1. In the Codespace terminal, run `claude` (or `claude setup-token`).
2. A browser popup appears asking "Do you want Code to open the external website?" — this points to a short URL ending in a redirect. If opened, it redirects to localhost:PORT/callback, which fails with ERR_CONNECTION_REFUSED (localhost is not reachable from the browser in this environment).
3. Instead, use the longer plain-text URL printed separately in the terminal output (starts https://claude.com/cai/oauth/authorize?code=true&client_id=...). Paste this into a browser tab manually.
4. Complete the Anthropic authorization screen ("Claude Code would like to connect to your Claude chat account") and click Authorize.
5. The browser redirect still fails (same ERR_CONNECTION_REFUSED on localhost), or in the setup-token flow, a code is expected to be pasted back into the terminal at "Paste code here if prompted >".
6. Copy the code (and/or state parameter) from the resulting URL and paste it into the terminal.
7. Terminal returns: "OAuth error: Invalid code. Please make sure the full code was copied" and offers "Press Enter to retry."

This was repeated multiple times with fresh codes, using: code alone, code+state concatenated with '#', and via both /login and setup-token flows. Same result every time.

### Claude Model

None

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

Unknown exact version — this Codespace has authenticated successfully many times over several months prior to this session. First failure was today.

### Claude Code Version

2.1.252 (Claude Code)

### Platform

Anthropic API

### Operating System

macOS

### Terminal/Shell

VS Code integrated terminal

### Additional Information

- echo $ANTHROPIC_API_KEY returns empty — no alternate auth path available.
- Claude Code self-updated during troubleshooting (confirmed via "Update installed · Restart to update" message); version remained 2.1.252 after restart, and the issue persisted.
- The auto-launched popup dialog and the plain-text URL printed in the terminal appear to be two different URLs with different redirect targets — only the popup's URL attempts the localhost redirect that fails. This inconsistency may be relevant to the root cause.
- Screenshots of the exact terminal output and error state are available on request.

Start with the `claude` `/login` and `claude setup-token` entry points, comparing the popup URL with the plain-text authorization URL and their localhost callback targets. Reproduce in a GitHub Codespace and trace the OAuth callback and pasted-code handling. Done means both flows authenticate successfully without relying on a browser reaching the Codespace's localhost.

Written by the indexing model from the issue text.